Level 1 — Foundations · wrap-up
Cheat sheet & self-check
35 questions across 8 lessons. Each answer links back to the lesson it came from.
Pick an answer to see if you got it, and why.
Q1. What does kind actually run each Kubernetes node as?
Show answer
B. kind means 'Kubernetes in Docker'. Every node is a container running systemd, containerd and the kubelet, which is why it starts in seconds and costs nothing.
From lesson 01 · Set up your practice labQ2. Which file tells kubectl how to reach and log in to a cluster?
Show answer
B. kubectl reads the kubeconfig (~/.kube/config by default, or $KUBECONFIG). kind writes a new context called kind-<name> into it when it creates a cluster.
From lesson 01 · Set up your practice labQ3. You run 'kubectl get nodes' and see 'The connection to the server localhost:8080 was refused'. What is most likely wrong?
Show answer
B. localhost:8080 is kubectl's fallback when it finds no kubeconfig. Check 'kubectl config get-contexts' and select a context.
From lesson 01 · Set up your practice labQ4. Why is a disposable lab cluster valuable, even for experienced engineers?
Show answer
B. Breaking things safely is how you learn what failure looks like. With kind, 'kind delete cluster' and 'kind create cluster' take about a minute.
From lesson 01 · Set up your practice labQ5. Where does Kubernetes store the desired state of every object?
Show answer
B. etcd is the cluster's database. Only the API server talks to etcd directly; every other component reads and writes through the API server.
From lesson 02 · Architecture & the control planeQ6. You stop the scheduler. What happens to pods that were already running?
Show answer
B. The scheduler only decides where new pods go. Running pods are managed by the kubelet on their node and are unaffected.
From lesson 02 · Architecture & the control planeQ7. Which component actually starts containers on a worker node?
Show answer
C. The kubelet watches for pods assigned to its node and asks the container runtime (containerd, via CRI) to pull images and start containers.
From lesson 02 · Architecture & the control planeQ8. A pod is deleted and a Deployment immediately creates a new one. Which component noticed and acted?
Show answer
B. Controllers run reconcile loops: they compare desired state (3 replicas) with actual state (2) and act to close the gap. The ReplicaSet controller created the new pod.
From lesson 02 · Architecture & the control planeQ9. Why does kubectl keep working after one of three control-plane nodes dies in an HA cluster?
Show answer
B. With 3 etcd members, 2 is still a majority (quorum), so reads and writes continue. Lose 2 of 3 and etcd stops accepting writes.
From lesson 02 · Architecture & the control planeQ10. You create a bare Pod (no Deployment) and its node dies. What happens?
Show answer
B. A bare Pod has no controller watching it. Use a Deployment (or another workload controller) for anything you want kept alive.
From lesson 03 · Pods, Deployments & workload typesQ11. Which workload type fits a PostgreSQL database with its own disk per replica?
Show answer
C. StatefulSets give each replica a stable name (db-0, db-1) and its own PersistentVolumeClaim that follows it across restarts.
From lesson 03 · Pods, Deployments & workload typesQ12. You need exactly one log-collector pod on every node, including nodes added later. Which workload?
Show answer
B. A DaemonSet runs one pod per (matching) node and automatically adds a pod when a new node joins.
From lesson 03 · Pods, Deployments & workload typesQ13. A pod shows CrashLoopBackOff. What is the most useful first command?
Show answer
B. CrashLoopBackOff means the container starts and then exits. --previous shows the logs of the run that crashed, which usually says why.
From lesson 03 · Pods, Deployments & workload typesQ14. During a rolling update, what connects the Deployment to its pods?
Show answer
B. Deployments own ReplicaSets, and ReplicaSets select pods by label. Each rollout creates a new ReplicaSet and scales the old one down.
From lesson 03 · Pods, Deployments & workload typesQ15. Why not just connect to a pod's IP address directly?
Show answer
B. Every restart, rollout or reschedule creates a new pod with a new IP. A Service tracks the current pods by label and keeps one stable IP and DNS name.
From lesson 04 · Services, DNS & basic networkingQ16. A Service exists but has no endpoints. What's the most likely cause?
Show answer
B. Endpoints are the Ready pods whose labels match the selector. A typo in a label, or pods that never become Ready, leave the Service empty.
From lesson 04 · Services, DNS & basic networkingQ17. From a pod in namespace 'shop', which name reaches Service 'api' in namespace 'payments'?
Show answer
B. Short names resolve within your own namespace. To cross namespaces use <service>.<namespace>, or the full api.payments.svc.cluster.local.
From lesson 04 · Services, DNS & basic networkingQ18. Which Service type opens the same port (30000–32767) on every node?
Show answer
B. NodePort allocates a port in the 30000–32767 range on every node and forwards it to the Service. LoadBalancer builds on NodePort in most clouds.
From lesson 04 · Services, DNS & basic networkingQ19. You can't ping a ClusterIP, but curl to it works. Is something broken?
Show answer
B. With kube-proxy in iptables/IPVS mode, nothing 'owns' the ClusterIP. Rules only match the Service's TCP/UDP ports, so ICMP ping typically gets no answer.
From lesson 04 · Services, DNS & basic networkingQ20. What's the difference between an Ingress object and an ingress controller?
Show answer
B. Without a controller, Ingress objects do nothing. That's the most common beginner surprise.
From lesson 05 · Ingress: getting traffic inQ21. The controller's Service shows EXTERNAL-IP <pending> on a bare-metal cluster. Why?
Show answer
B. Kubernetes asks for a load balancer but doesn't include one for bare metal. Lesson 11 adds MetalLB.
From lesson 05 · Ingress: getting traffic inQ22. ingress-nginx returns 503 Service Temporarily Unavailable for a path. What's the first thing to check?
Show answer
B. 503 usually means the rule matched but there are no healthy pod endpoints to send to. A 404 means no rule matched.
From lesson 05 · Ingress: getting traffic inQ23. You update a ConfigMap that a Deployment uses as environment variables. What do running pods see?
Show answer
B. Environment variables are read once, when the container starts. Restart the pods (for example kubectl rollout restart) to pick up changes.
From lesson 06 · Configuration & SecretsQ24. Is a Kubernetes Secret encrypted by default?
Show answer
B. base64 is an encoding, not encryption. Protect Secrets with RBAC, enable encryption at rest (for example with KMS), and consider an external secret manager.
From lesson 06 · Configuration & SecretsQ25. Which approach lets a running app see config changes without a restart (eventually)?
Show answer
C. The kubelet refreshes ConfigMap volumes periodically, so files update after a short delay. The app must re-read them. subPath mounts do not update.
From lesson 06 · Configuration & SecretsQ26. What is the main benefit of keeping configuration out of the container image?
Show answer
B. Build once, configure per environment. It is a core idea of the Twelve-Factor App and makes promotions between environments safe.
From lesson 06 · Configuration & SecretsQ27. A container writes a file to its own filesystem and then crashes. After the restart, is the file there?
Show answer
B. The container filesystem is ephemeral. Anything that must survive a restart belongs in a volume (emptyDir survives container restarts within the same pod; a PVC survives the pod itself).
From lesson 07 · Storage basicsQ28. Your new PVC stays Pending, and describe says 'waiting for first consumer to be created before binding'. What should you do?
Show answer
B. With volumeBindingMode: WaitForFirstConsumer, provisioning waits until a pod is scheduled, so the disk is created in the right zone or node.
From lesson 07 · Storage basicsQ29. What does ReadWriteOnce actually restrict?
Show answer
B. RWO is per node, not per pod. If you need a single-pod guarantee, use ReadWriteOncePod.
From lesson 07 · Storage basicsQ30. What happens to the data when you delete a PVC whose StorageClass has reclaimPolicy: Delete?
Show answer
B. Delete is the default for dynamically provisioned volumes. For important data use Retain (and backups), so deleting a claim doesn't destroy the disk.
From lesson 07 · Storage basicsQ31. Why does the postgres Deployment use strategy: Recreate instead of the default RollingUpdate?
Show answer
B. A rolling update starts the new pod first. With a single-writer volume that means a stuck Multi-Attach, or worse, two database processes on the same files. Recreate stops the old pod first.
From lesson 08 · Checkpoint: deploy a 3-tier appQ32. nginx is configured with proxy_pass http://adminer:8080. How does 'adminer' become an IP address?
Show answer
B. The pod's /etc/resolv.conf includes the search domain shop.svc.cluster.local, so the short name 'adminer' resolves to the Service in the same namespace.
From lesson 08 · Checkpoint: deploy a 3-tier appQ33. You delete the postgres pod. Why is the orders table still there afterwards?
Show answer
B. The Deployment creates a new pod, which mounts the same PersistentVolumeClaim. The data directory, and your table, are still on it.
From lesson 08 · Checkpoint: deploy a 3-tier appQ34. After editing the nginx ConfigMap, what makes nginx serve the new config most reliably?
Show answer
B. The mounted file updates eventually, but nginx only reads it at start or reload. A rollout restart replaces the pods gracefully, and the new ones load the new config.
From lesson 08 · Checkpoint: deploy a 3-tier appQ35. The site returns 502 Bad Gateway. The web pods are Running. What do you check next?
Show answer
B. 502 from nginx means it could not get a good answer from the upstream. Walk the chain: adminer Service → endpoints → adminer pods Ready?
From lesson 08 · Checkpoint: deploy a 3-tier app